X / xAI · Report #187714
Vine - overwrite account associated with email via android application
Validstatus
mediumseverity
$280bounty
30upvotes
14 Jun 2017disclosed
Summary
A logic issue in the Vine signup flow allowed a user to create a new account that would be associated with a user’s email, which could result in the user being unable to access their original account.
How it was found
Hi,
It's possible to deny any user from logging in to his account by overwriting the password associated with his email. This is not an account takeover because while we do override the password associated with that specific mail we just login to a "new" account and not the user's original one.
Steps to reproduce:
- Create first account via Vine for android with the mail [email protected] with the password Bla123
- You can now see that you can login to the account created above.
- Go and create another account - this time with a different password and with the mail [email protected] - notice the CAPS (you can put the caps everywhere on the mail).
- Finish the creation process - and see that it succeeds
- Now go back and try to login with [email protected] and the password Bla123 and see that you can't. However, it's possible to login with [email protected] and the second password you have created - but you"ll login to the second created account.